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APOLLO EXPERIENCE REPORT 

CERTIFICATION TEST PROGRAM 

By Joseph H. Levine and Bill J. McCarty 
Manned Spacecraft Center 

SUMMARY 


The Apollo Spacecraft Certification Test Program was designed to ensure vigor- 
ous testing of the flight hardware in simulated flight conditions before flight. To 
accomplish this test program, various approaches were studied, and an integrated 
test and analysis approach using a limited amount of hardware to provide engineering 
confidence resulted. Statistical demonstration of the reliability of the hardware was 
abandoned as an approach because of impracticality and fiscal considerations. Every 
test anomaly was carefully evaluated, and recurrence control was initiated to ensure 
early maturity of the hardware. The certification test approach used in the Apollo 
Spacecraft Program is applicable to future manned spacecraft, but caution should be 
exercised in tailoring the certification test program to new applications. 


INTRODUCTION 


Ground and flight tests were of significant importance in the development of the 
Apollo spacecraft hardware. In this report, the Apollo spacecraft certification testing 
portion of the Apollo test program is discussed. 

The two basic categories of the Apollo ground test program are described as 
design development testing and acceptance checkout testing. Preprototype, prototype, 
and production hardware were used during design development testing and are described 
generally as design feasibility, design verification, and certification testing, 
respectively. 

The purpose of design development testing was to ensure that the hardware design 
was adequate for the performance of specified functions for the time and under the 
spectrum of "worst case" environments that were expected for a like piece of hardware 
during the combined ground and flight life of the hardware. Development test hardware 
was used solely for testing and not for flight. 

Acceptance and checkout testing was intended to ensure that the manufactured 
hardware had no latent defects and that the equipment conformed to functional specifica- 
tion requirements. The program consisted of functional and, in many cases, environ- 
mental testing of the hardware at the manufacturing plant, functional testing at the 
prime contractor's facility before installation into the spacecraft, and a logical and 


thorough series of ambient functional subsystem and system checkout tests after hard- 
ware installation in the spacecraft at the prime contractor's facility. Many of these 
exhaustive series of tests were repeated at the NASA John F. Kennedy Space Center 
(KSC), culminating in the final countdown tests before lift-off. This complete range of 
hardware acceptance and checkout tests was conducted only on hardware that was to be 
flown. 


Although valuable experience was gained in all the test areas, the scope of this 
report is restricted to the final portion of the design development testing (certification 
testing). The following facets of the certification test program are described in detail. 

1. Establishment of the test requirements, environments, durations, and levels 
of exposure 

2. Management controls before, during, and after testing 

3. Knowledge gained and results obtained from the program 

In addition, a brief discussion of the potential role of certification testing in future 
manned spacecraft programs is presented. 


REQUIREMENTS 


At the beginning of the Apollo Spacecraft Program, three primary test concepts 
were studied to determine the optimum method for the certification of the design of the 
spacecraft hardware. The first test concept considered was a statistical demonstration 
test program that would provide the rigor associated with demonstrating the reliability 
of the hardware statistically and would produce a significant amount of test data and 
test experience on production hardware. This approach, however, would require an 
increase of at least 15 to 20 times the number of test articles with attendant large costs 
and schedule implications. 

The second test concept considered was a non -time -oriented design -limit test 
program in which production hardware would be used to demonstrate the capability of 
the hardware to withstand the severity of the flight environments increased by a factor 
of safety. A limited amount of test data would be obtained rapidly, and the tests would 
require a limited amount of test hardware. However, no statistical confidence in the 
reliability of the hardware would be produced, and the time -oriented sequential expo- 
sure of the hardware to the levels and durations of the environments expected in flight 
would be omitted. 

The third test concept considered was an integrated test and analysis program in 
which two production units of hardware would be used, one unit for design -limit testing 
and the second unit for mission-life testing. This program would not require an exces- 
sive amount of hardware and would demonstrate the capability of the hardware to with- 
stand the full mission spectrum of environmental magnitudes and durations with 
adequate margins of safety. More test articles would be required during the testing of 
certain critical items such as those in the propulsion system and during the testing of 
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high -usage hardware such as switches and relays. Although a statistical demonstration 
of the reliability of the hardware would not be obtained, this approach would provide a 
significant degree of confidence in the design. The acceptance test would then provide 
the necessary confidence in the quality of the flight hardware. 

The third test concept was selected for the certification test program. Testing 
was performed at the line replaceable unit (LRU) and at selected higher levels of 
assembly to ensure equivalent certification testing of the entire spacecraft. Hardware 
levels of assembly were tested, ranging from switches, dials, and meters to mechani- 
cal and electrical subassemblies, gyros, and computers. Also included in the testing 
were valves, tanks, and complete engines. More than 700 certification tests for the 
command and service module (CSM) and more than 500 certification tests for the lunar 
module (LM) were required to be completed successfully before flight. Complete sub- 
system and vehicle -level tests were included in the program to demonstrate the design 
capability of the interfaces between hardware elements (more than 125 tests for the 
CSM and 175 tests for the LM). 

The establishment of certification test requirements to which the Apollo space- 
craft hardware was to be exposed was a lengthy and, in some cases, an iterative proc- 
ess. The design environments were known, but some of the level and duration 
requirements were developed over a period of time. For example, development of 
the definition of the vibration environment spanned several years as knowledge of the 
actual flight vibration environment increased. Environments that were considered for 
each LRU included vibration, temperature, shock, acceleration, corrosive contami- 
nants, vacuum, salt spray, sand and dust, humidity, oxygen, and pressure. All the 
environments to which the hardware would be exposed during acceptance tests, space- 
craft assembly, transportation (both ground and air), spacecraft checkout, launch- 
site preparations, launch, and mission (including earth orbit, translunar and transearth 
coasts, entry, and landing) were considered. The hardware was then tested in a logi- 
cal sequence to the most critical level of these environments. 

The selection of the items to be exposed to a particular environment at a particu- 
lar level and duration was determined on an item -by -item basis. This selection was 
made: (1) by assessing the type of hardware construction, the location of the hardware 
in the spacecraft, and the expected duration of hardware exposure to a particular 
environment; and (2) by determining whether the hardware was operational before, 
during, and after exposure. Conservative levels for environmental testing were 
selected to provide an adequate margin above the environments expected during flight. 
At the same time, care was taken to prevent the use of unrealistically severe levels. 

After the environments and durations were determined for a given unit of hard- 
ware, the certification test requirements (CTR’s) were formally documented for 
approval at the NASA Manned Spacecraft Center (MSC) before testing. All the CTR's 
developed for one given mission were known as a certification test network. 

Vibration levels to which the Apollo spacecraft (CSM and LM) are subjected 
during the launch and boost phases of flight were primarily acoustically induced. Data 
on acoustic levels were obtained from wind-tunnel tests and from Little Joe n, early 
Saturn I, Saturn IB, and Saturn V flight tests. These data were used in vibroacoustic 
ground tests on full-scale LM and CSM structural test articles to certify the structure 
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of each and to determine the vibration response levels at equipment locations within 
the vehicle. The vibration levels determined from these tests were used for testing 
individual components. As additional data became available from the LM and CSM 
vibroacoustic vehicle tests, necessary adjustments were made to the existing vibration 
test requirements. 

Similar care was taken in the development of the exposure levels for the other 
ground and flight environments. Unrealistic environmental requirements could penalize 
hardware design and require extensive retesting because hardware certification tests 
were conducted concurrently with the installation of like items of hardware into flight 
vehicles. Hardware failures during unrealistically high environmental exposure levels 
could have resulted in unnecessary design changes and a resultant waste in funds and 
schedule time. As a supplement to the certification test program, a selected number 
of off-limits tests were conducted on certification hardware at higher environmental 
exposure levels to gain a better understanding of the actual hardware limitations. 
Failures during this type of testing were assessed from this standpoint and resulted 
in few design changes. 

Ideally, an item of flight hardware would be subjected to one environmental 
acceptance test, one prelaunch checkout, and one mission. Practically, however, 
almost all the flight hardware could be subjected to more than one environmental 
acceptance test as a result of reacceptance after repairs or modification following the 
initial acceptance. The certification testing was thus arranged to demonstrate the 
capability of the hardware to withstand at least five environmental acceptance tests and 
still perform properly in tests that were equivalent to one complete prelaunch checkout 
and two complete missions. It was considered that a total of five acceptance tests was 
a practical upper limit of refurbish and retest cycles, and that testing for two full 
mission durations would give a practical and acceptable measure of performance 
margins. 

The sequence in which the environments were applied to the test article approxi- 
mated the sequence in which the flight article would be subjected to these environments 
during the ground and flight life of the article. The range of environmental exposure 
levels for Apollo hardware is shown in table I. 

A typical set of test requirements for one piece of electronic equipment, the LM 
S-band transceiver, is shown in table It. After this piece of hardware had been tested 
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successfully at pressures lower than 1 x 10 torr, it was determined that the equip- 
ment is required to operate at higher pressures. The S-band transceiver is located 
in the aft equipment bay of the LM on the outside of the pressure cabin but inside the 
thermal insulation and skin of the LM. The pressure in this region was determined to 

-3 

be in the range of 10 to 1 x 10 torr. A decision was made to retest the transceiver in 
the higher pressure range in which some electronic equipment was known to be sensi- 
tive to the corona discharge phenomenon. The test was conducted, and failures attrib- 
utable to corona were corrected by pressurizing the transceiver. The validity of the 
design change was verified by subsequent testing. This example, in which the most 
severe environment for the equipment was not the most severe absolute environment 
(i. e. , less than hard vacuum), also demonstrated the necessity for adjusting the 
requirements based on current knowledge of the operating environment. 
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| TABLE I. - RANGES AND ENVIRONMENTS OF SPACECRAFT COMPONENTS 

t 


Basic test type 

Test level 

Environmental conditions 

Vibration 

Acoustics 

Acceleration 

0. 015 to 14 g^/Hz 
67 to 165 dB 
Up to 20g 

< 

f Ground phases 

Transportation and 
handling 
Static firing and 
acceptance test 

Shock 

To a maximum of 78g 

Flight phases 
Boost phase 
Space flight phase 
^ Entry phase 

Temperature 

-250° to 60° F 


' Natural conditions 

Transportation, ground 
handling, storage 
Sheltered 

Earth parking orbit to 
preentry phase 
Postlanding 



< 

Induced conditions 

Transportation, ground 
handling, storage, 
checkout 
Sheltered 
Boost phase 
Earth parking orbit to 
preentry phase 
Lunar landing 
V Entry phase 

Corrosive contaminants 

1 percent salt spray 



Oxygen 

95 percent dry oxygen at 
5 psia 



Humidity 

Relative humidity at 
5 psia and 60° to 90° F 



Thermal vacuum 




Temperature 

-300° to 270° F 



Pressure 

_5 

As low as 1 x 10 torr 
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TABLE n. - SET OF CERTIFICATION TEST REQUIREMENTS 
FOR THE LM S-BAND TRANSCEIVER 


Test conditions 


Acceptance 


Temperature 


Vibration 


Levels and exposure 


-20° F for 6 hr 
15° F for 6 hr 
110° F for 6 hr 
145 5 F for 6 hr 

Launch and boost a 

Random: 2-1/2 min in each of the 
3 mutually perpendicular axes 
for 7-1/2 min 

2 , 

20 to 2000 Hz 0.005 g /Hz 

Sinusoidal vibration frequency shall 
be swept logarithmically from 
5 to 100 to 5 Hz at 3 octaves/min 
for 1 sweep cycle along the 
X-axis, Y-axis, and Z-axis. 

5 to 10 Hz 0.2 double 

amplitude 

10 to 100 Hz l.Og 

Lunar ascent and descent 3 

Random: 21 min in each of the 
3 mutually perpendicular axes 
for 63 min 

Z-axis 


Remarks 


To be conducted in accordance with 
applicable procedure. 

Equipment nonoperating during test. 
Tests to be conducted in accordance 
with applicable procedure. 


Equipment nonoperating. 


10 to 20 Hz 

12 dB/octave 

20 to 100 Hz 
100 to 120 Hz 

0.01 g 2 /Hz 
24 dB/octave 

120 to 150 Hz 
150 to 180 Hz 

0.45 g 2 /Hz 
-24 dB/octave 

180 to 2000 Hz 

0. 005 g 2 /Hz 

X-axis and Y-axis 


10 to 20 Hz 

12 dB/octave 

20 to 100 Hz 
100 to 120 Hz 

0.01 g 2 /Hz 
-12 dB/octave 

120 to 2000 Hz 

0. 005 g 2 /Hz 

Sinusoidal vibration frequency shall 
be swept logarithmically from 
5 to 100 to 5 Hz at 1/2 octave/min 
for 1 sweep cycle along the 
X-axis, Y-axis, and Z-axis. 

5 to 30 Hz 
30 to 100 Hz 

0. 03 double 
amplitude 
1.4g 


Equipment operating. 


a To be followed by an operational test conducted in accordance with applicable procedure. 


6 


i 

I 

TABLE II. - SET OF CERTIFICATION TEST REQUIREMENTS 
FOR THE LM S-BAND TRANSCEIVER - Concluded 


Test conditions 

Levels and exposure 

Remarks 

Acceleration 

X-axis: 7.4g 
Y-axis and Z-axis: -- 
Duration: 3 min 

Equipment nonoperating during test. 

To be conducted in accordance with 
applicable procedure. 

Thermal vacuum 3 

-5 

Pressure: 1 x 10 torr 

Equipment nonoperating for cold soak. 


Temperature at root of flange: 35° F 
for 48 hr 



Followed by thermal vacuum profile 
35° to 135° F 
10 to 1 x 10' 4 torr 

Thermal vacuum profile to be per- 
formed twice with simultaneous 
operation of primary mode and 
secondary mode. 

Lunar landing shock 

Shock pulse, sawtooth, 15g peak, 

11 ± 1 msec rise, 1 ± 1 msec decay, 
1 pulse/direction for a total of 
6 pulses 

Equipment operating during test. To 
be conducted in accordance with 
applicable procedure. 

Sea air humidity 

The test shall be conducted in accord- 
ance with applicable procedure ex- 
cept as follows: temperature, 90° F 
(+5°); salt concentrate, 1 percent 
(+0. 5 percent, -0. 0 percent); cham- 
ber humidity, 85 percent (+15 per- 
cent, -10 percent); exposure, 24 hr; 
method* 2 min/hr. Operational 
test to be performed on the assem- 
blies in accordance with applicable 
procedure. 

Equipment nonoperating during test. 

Additional vibration 3 

Random: 5 min in each of the 3 mutu- 
ally perpendicular axes for 15 min 

Equipment operating. 


20 to 80 Hz 3 dB/octave 

2 

80 to 350 Hz 0. 067 g /Hz 

350 to 2000 Hz -3 dB/octave 


Electromagnetic 
interference (EMI) 
plus integration 
and checkout after 
acceptance test 
and before launch 

Ambient conditions: each electronic 
replaceable assembly (ERA) shall be 
operated for a minimum of 250 hr in 
accordance with operational test 
procedures. 

This condition simulates the total oper- 
ating time accumulated on each ERA 
from point of shipment to contractor 
through all checkout and acceptance 
testing before launch at KSC. EMI 
to be conducted in accordance with 
applicable procedure. 


a To be followed by an operational test conducted in accordance with applicable procedure. 
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MANAGEMENT CONTROLS 


The multitude of certification tests to be conducted, the numerous locations 
across the country at which the testing was done, and the large numoer of persons 
involved necessitated a thorough management control system. Although the successful 
development of spacecraft hardware cannot be reduced to a specific formula, a series 
of specific requirements was used to manage the certification test program. Those 
requirements considered significant are as follows. 

1 . Testing of the hardware to demonstrate design capability 

2. Use of production hardware 

3. Testing of units at the highest practical level of assembly 

4. Use of two test articles for design-limit testing and mission-life testing 

5. Use of natural and induced environments 

6. Use of combined environments when practical 

7. Testing of all redundant paths 

8. Performing acceptance testing before certification testing 

9. Use of certification by similarity to eliminate test duplication 

10. Use of analysis to supplement testing 

11. Testing at higher levels of assembly and at vehicle-level phases to demon- 
strate interfaces 

12. Thorough understanding of all anomalies 

13. Use of positive corrective action for anomalies and retesting as appropriate 

14. Recertification after design, process, and manufacturing changes 

15. Successful completion of all certification tests before flight 

First, the use of testing as the primary method for the demonstration of hardware 
capability under environmental stress was undoubtedly the key to the success of the 
certification test program. An attitude of "proof through testing" was dominant in the 
management of the test program. 

The use of production hardware, whereby the test article was produced under the 
same design manufacturing processes and controls as the flight hardware, ensured that 
the minor, and sometimes subtle, design or process changes (from which new failure 
modes can be introduced) were adequately tested. 
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Units were tested at the highest practical level of assembly to ensure the dis- 
covery of as many of the interface problems as possible. Although this procedure was 
often dictated by the level of assembly at which a particular manufacturer produced 
hardware, additional higher level -of -assembly tests were conducted. For example, 
the display and control panels and the consoles in the spacecraft cabin were tested 
environmentally as complete built-up assemblies even though similar individual instru- 
ments and control devices on the panels previously had been subjected to separate certi- 
fication tests. 

Where possible, two test articles were used, one for design-limit testing and the 
other for mission-life testing, to give the assurance of an adequate margin of safety 
for environmental exposure as well as for operating time and operating cycle. 

The use of natural and induced environments assured that all possible environ- 
mental factors were considered and imposed on the hardware. For example, the cor- 
rosive contaminants, oxygen, and humidity (CCOH) tests imposed on hardware located 
in the cabin combined requirements that simulated the manned crew compartment 
atmosphere. 

When practical, combined environmental exposures were used. The CCOH test- 
ing and the combination of thermal cycling and vacuum testing are examples of environ- 
ments that were combined most frequently. 

Demonstration testing of all the redundant paths in the equipment was required. 
The functional testing of hardware, to detect intermittencies while the hardware was 
exposed to an environment, was performed to the greatest possible extent. 

Acceptance tests were performed on the certification hardware before certifica- 
tion testing was begun. This testing sequence provided assurance that the test hardware 
was free of manufacturing defects, and that the hardware was subjected to the same 
total envelope of environmental exposure to which the actual flight articles would be 
subjected. 

Because the use of certification by similarity was permitted in the guidelines, 
duplication of testing was eliminated. For hardware common to the LM and the CSM, 
tests were conducted to the levels at which the environments in those areas were the 
most severe. As a result, cost savings were realized. 

The use of analysis to supplement testing was common, but the substitution of 
analysis for testing was permitted only when testing was impractical or impossible. 

For example, numerous tests were conducted on the LM landing gear to demonstrate 
adequate structural design margins. These tests included 16 drop tests of a structural 
test article and five drop tests of a flight -configured LM to simulate the more critical • 
loading conditions on the total vehicle. However, because of the numerous combina- 
tions of landing velocities, attitudes, and angular rates resulting in different sets of 
landing stability dynamics and load inputs to the structure, it was necessary to perform 
the primary certification for these two factors by analysis and to obtain point confirma- 
tion by test procedure. More than 40 000 kinematic loads cases and 17 000 computer 
simulations of the landing dynamics and loads were analyzed. 
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Tests at the higher level -of -assembly and vehicle-level phases of the certification 
test program were likewise exhaustive for the demonstration of the interfaces and the 
interacting effects of the hardware of a given module. The vibroacoustic testing of the 
entire LM and CSM ground test spacecraft, the land and water impact tests on the com- 
mand module, the LM drop tests, the thermal vacuum tests of the full-scale LM and 
CSM vehicles, and the full-scale launch escape system tests conducted at the White 
Sands Test Facility added thousands of ground test hours to flight -configured hardware. 

A thorough understanding of all anomalies was another enforced ground rule. The 
concept of a random failure was unacceptable to management. It was acknowledged that 
hardware failures were caused by discrete flaws in design, manufacturing, or proce- 
dures, and the function of the personnel responsible for the hardware was to understand 
the cause of any anomaly and to ensure that the particular problem did not recur in 
flight. 


Positive corrective action for all anomalies and retesting to ensure the adequacy 
of the corrective action were performed in virtually all cases. The corrective action 
could be one of hardware redesign, hardware manufacturing, hardware quality control 
improvement, or procedural change. 

Some typical problems and resolutions are as follows. 

1. The suit fan stopped running after shock test. A main -bearing failure was 
suspected. A failure analysis showed that the bearings were contaminated from manu- 
facturing procedures. In addition, the grease used was not suitable for this application, 
and improper fan -to -housing clearances were used. The rotor was not balanced cor- 
rectly, and the fan housing was of insufficient strength. These problems were correct- 
ed by design and manufacturing process changes, and retesting verified the adequacy of 
these changes. 

2. An excessive rate of oxygen depletion from one of the oxygen tanks was expe- 
rienced after a 15 -hour thermal stabilization period. This depletion was caused by the 
scrubbing action of the insulation during vibration, resulting in a vacuum degradation 
and excessive oxygen boiloff. Because this action would have an effect on long -duration 
lunar missions, a vacuum -ion pump was installed to improve the vacuum retention 
qualities of the tank. Retesting verified the adequacy of the redesign. 

3. During waveform and percent modulation tests on an inverter modulation test 
at 30 -volt direct current input, erratic frequency and voltage outputs were noted. 
Transistor pairs were not matched for gain. The problem was corrected by matching 
the gains of transistor pairs; this corrective action was proved to be effective. 

4. During the testing of a fuse assembly for the LM, numerous open or intermit- 
tent circuits were observed. These failures were caused by the heat of soldering the 
fuse (small thermal mass) to the wafer terminals (large mass). This heat was being 
conducted down the fuse leads and was softening the fuse cement or melting the fuse 
element (or both). This failure condition was also prevalent during acceptance testing 
of a subsequent generation of production hardware. 
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Original attempts to correct this problem by substituting a different fuse and a 
wider wafer separation to provide more positive heat sinking were not successful. The 
final corrective action, which was proved successful by retesting, resulted in changing 
the assembly process from soldering to a machine -controlled welding operation. 

The successful completion of all required preflight certification testing has been 
accomplished for all Apollo spacecraft flown to date. In addition, MSC approval of all 
certification requirements, changes, and test results was required. 

The normal approval cycle required the prime contractors to submit the certifi- 
cation test results to MSC as soon as the findings were available, allowing MSC and the 
contractor to review the test results simultaneously. If the contractor approved the 
test results, with or without reservations, as being adequate to certify the hardware for 
flight, these findings were documented formally and forwarded to MSC for approval. 

The approval of the MSC Subsystems Manager and MSC Reliability and Quality Assur- 
ance was required. 

In cases where certification testing or retesting occurred just before a launch 
date or a critical test at KSC, MSC personnel would witness the test and review onsite 
raw test data, and a Qualification Site Approval would be granted, if appropriate. This 
process permitted immediate certification of the hardware for the mission, pending the 
review of the formal test report from the contractor. 


RESULTS 


The results of the certification test program are considered to be both qualita- 
tive and quantitative. Included in the qualitative results are the following. 

1. The use of failure modes and effects analysis was helpful in understanding the 
criticality of the hardware being tested and deciding whether failure could involve crew 
safety, affect mission success, or just be a nuisance in flight. This knowledge also 
was important to the decisionmaking process during corrective action procedures after 
the occurrence of a hardware failure. This analysis technique was not limited to certi- 
fication testing but was equally useful for the entire ground test program. 

2. Certification testing at the highest practical level of assembly did not elimi- 
nate the need to qualify and conduct screening and burn-in tests on electrical, electronic, 
and electromechanical (EEE) piece parts. Controlled EEE piece parts were neces- 
sary if the certification test results were to be applicable to identical flight hardware. 

3. Tear down inspection after test completion provided the capability for the 
determination of incipient failures that were not detected with the test instrumentation. 

4. Because of the inherent lag in the preparation of test reports, onsite review 
of raw test data was required when successful test completion was a constraint to an 
imminent flight. 

5. Although the certification test program demonstrated design capability under 
environmental exposure, the program was not 100 percent effective in exposing all 
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design deficiencies. The environmental acceptance tests that were conducted on flight 
hardware for the primary purpose of detecting manufacturing flaws also resulted in the 
detection of soriie design problems, particularly in the designs that were difficult to 
manufacture. 

6. Certification by similarity required exhaustive review for acceptability. 
Likewise, when certification uras based on analysis rather than test, as much, if not 
more, review effort was required. 

Quantitative results of the certification test included the following. 

1. Certification testing, environmental acceptance testing, and actual flight were 
considered the three major areas in which Apollo hardware is exposed to environment. 
Considering only those design-related failures found in production hardware, 68 percent 
were found during certification testing, and 30 percent were found during the environ- 
mental acceptance testing (vibration and thermal cycling) of the flight hardware. These 
results illustrate the fact that some design weaknesses were hard to find, with a few 
remaining undetected during the design and development phase and the certification test- 
ing, and were finally discovered in the acceptance testing of the follow-on production 
hardware’. Many of these problems were producibility type problems incapable of de- 
tection with the few units being tested. The combination of certification and environ- 
mental acceptance testing kept the number of design problems to a minimum during 
flight . 


2. Certification testing also exposed 45 percent of the failures attributable to 
poor workmanship, although the certification hardware totaled considerably less than 
45 percent of the production hardware. The primary reason for this is that discovery 
of the workmanship problems during early testing of production hardware resulted in 
the implementation of corrective actions and controls, thus precluding manufacturing 
defects in follow-on production hardware. 

Additional quantitative results are evident from a representative distribution by 
environment of the design failures that occurred during certification testing. Of all the 
environments to which the hardware was exposed, more than three -fourths of the fail- 
ures were experienced in the vibration, thermal vacuum, and temperature -cycling 
environments. 


CONCLUDING REMARKS 


One possible recommendation for the design of a certification test program 
emphasizes dynamic environmental exposures. As previously mentioned, numerous 
failures that were attributed to hardware design were detected during tests in the launch 
vibration environment. Although Apollo spacecraft hardware was designed on the basis 
of a single launch vibration cycle, future space vehicle hardware may be required to 
survive numerous launch and reentry cycles. Because the major cost of conducting 
subassembly vibration tests is associated with the test setup and data- reduction time, 
rather than with the actual vibration exposure, the equivalent of numerous launch vibra- 
tion cycles should be conducted on the equipment once it is set up. By this means, the 
hardware design would be exposed to those vibration environments that have been 
proven by experience to be most likely to uncover design deficiencies. 


12 



The unique certification requirements for the long -duration space missions are 
governed by the extremely long times involved, in some cases as many as 10 years. 
Although the equipment is subjected to only a single launch environment, which can be 
tested, the long operational time in the space environment for equipment cannot be 
simulated in short-time testing with any degree of confidence. To date, no well demon- 
strated method exists for extrapolating compressed-time testing techniques for equip- 
ment that will undergo extended exposure to either pressurized or thermal vacuum 
environments. 

These factors and the need for ready accessibility to as much hardware as possi- 
ble for replacement capability may result in the requirement that all possible hardware 
be located within the pressurized, or at least the pressurizable, confines of the space- 
craft. Thus, the hardware systems within the space vehicle should probably be de - 
signed to allow for the inflight repair and replacement of failed hardware with spare 
hardware carried on board or supplied from earth for near-earth space operations. 

One possible approach for demonstrating the design of hardware for long -duration 
missions would be to use near-earth long-term space vehicles as inflight certification 
test sites. The data obtained from those test sites, could then be used, along with sup- 
plementary data from ground tests, to extrapolate performance to somewhat longer 
times in space. This approach would require an early hardware design freeze so that 
the results of the certification tests would remain valid for the later mission hardware. 

Only a few of the possible approaches that could be applied to the unique hardware 
certification requirements of future programs have been outlined. To date, no defini- 
tive decisions have been made. Many of the Apollo Spacecraft Certification Test Pro- 
gram guidelines can be applied to ensure that the hardware launched as a part of the 
U.S. space program is adequate for mission performances. 
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